WannaCry勒索软件分析

2017-5-14 Nie.Meining Debug

大家都知道,昨天WannaCry勒索软件在一夜之间利用系统漏洞席卷全球,特别是在内网和专网中,通过攻击445端口(蠕虫性质)大肆传播,造成了巨大数据损失。我也凑个热闹,找到一批样本上传金刚分析系统(http://tcasoft.com/),看看效果。

其中比较典型的分为两类,一类就是昨天大家新闻中看到的,访问某个超长的域名,如果存在就放弃攻击。如图:

2.png

1.png

其实这个“域名开关”并不完全可以保平安。还有一类样本一上来就搞破坏,并不会探测域名。如某样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=22bfa9109ab9d405af4188867620c730&sk=60036875

下面对该报告简单解读。

首先观察运行过程截图可以看出,样本执行初期没有任何引人注意的表现,当桌面被替换、前台弹出提示信息时,一切都为时已晚,用户的文件就已经被加密,要想恢复文件内容只能向攻击者提供的地址汇入300美元比特币了。如下图所示。

3.png

4.jpg


观察行为列表可以看到,样本释放了大量可执行程序以及bat、vbs等恶意脚本,并借助这些程序、脚本和Windows自带的系统工具共同完成攻击目的。例如通过attrib系统工具实现自我隐藏、利用icacls工具获取文件操作权限、利用vssadmin工具破坏系统还原功能、利用reg程序导入注册表实现自启动等。如下图所示。

5.png

6.png

7.png


一切就绪后,样本开始重头戏——文件加密。在行为列表中可以看到大量与文件操作相关的行为,包括修改文件属性、读写文件、修改文件创建时间、文件重命名等。这些正是WannaCry对用户文件进行加密的详细过程。如下图所示。

8.png


进一步观察样本的详细行为数据可以发现,攻击者其实会针对每个文件生成一个扩展名为WNCRYT的临时文件,在加密完成并设置好文件创建时间后,会将该临时文件重命名为WNCRY文件。如下图所示。

9.png


具体这些被加密后的文件长什么样呢?只需查看分析报告里的“中间文件”就可以看到。如下图所示,攻击者感兴趣的文件主要包括doc、xls、jpg等各种文档和图片,被加密后文件头部均变成了“WANACRY!”标识。

a.png


除了以上主机破坏行为以外,样本运行过程中还能观测到大量的网络行为,连接地址包括美国、德国、奥地利等多个国家,同时会尝试连接一个很长的域名。如图所示。

b.png

c.png


由于金刚系统在分析过程中,引擎并未连接真实互联网,因此网络行为我就没有展开分析了。其实该样本还有不少技术细节上文并未展开介绍,大家若有兴趣欢迎查看分析报告自行研究。

评论:

Edwardcep
2018-04-16 23:29
Wow! This might be by far the most helpful thing on the topic I've ever found. Thanks for your effort.
https://soicau68.000webhostapp.com/specialized-via-the-internet-dissertation/
JeffreyAcide
2018-04-16 23:24
When learners pay for essays they sometimes get caught by witty entrepreneurs offering up a cat during the sack to get a cost of a Malibu mansion | However, you would not.

http://paulandrewweiss.com/2018/01/college-paper-globe-original-papers-and-seasoned/
ScottIdeak
2018-04-16 23:00
This is a really great site!A lot of helpful info and handy ideas, thanks =)
http://centerforseniorbenefits.com/crafting-an-unforgettable-college-essay-admission-9/
Samuelswale
2018-04-16 22:49
Thank you for a really awesome blog. It was actually very helpful. I am so glad I discovered this.
http://www.travel-cakrawala.com/index.php/2016/12/13/essay-writing-service-custom-writing-paper-writing-146/
MatthewPhowl
2018-04-16 21:36
Most useful and low-cost essay crafting assistance via the web | We will create for you personally argumentative essays, promts, feedback.

http://earth-official.net/4842
AaronBob
2018-04-16 21:33
A short while ago I've come across one article which I believe you might find interesting. Someone might take a steaming dump all over it, but it clarified some of my questions.
http://eye4design.com.br/the-order-of-operations-pemdas-purplemath-9/
ScottIdeak
2018-04-16 21:17
This is an excellent article. This site has lots of useful things, it really helped me in many ways.
https://careersinfitnessltd.co.uk/essays-to-purchase/purchase-abortion-essay-100-original-and-custom-3/
ThomasDog
2018-04-16 20:57
I like to get my inspiration from really meaningful phrases said by truly great people like “Good and evil, reward and punishment, are the only motives to a rational creature”, do you know where I can find thematic compiltaions of those?

http://www.coloursplash.ie/2016/09/employ-a-top-notch-study-paper-writing-service-15/
Darrellmef
2018-04-16 20:40
it's my very first time visiting your site and I'm very interested. Thank you for sharing and keep up ;)
http://dutchgardenofdreams.ae/help-me-do-my-paper-now/dissertation-consulting-precision-consulting-170/
Donaldcon
2018-04-16 20:29
Many thanks for sharing with us, I always find out something new from your posts.
http://tpguru.ru/help-me-do-my-paper-now/college-paper-world-original-papers-and-13/
Donaldcon
2018-04-16 20:00
Thank you for sharing with us, I always find out new things from your posts.
http://www.flowerandlove.se/blog/2016/03/14/15-off-to-attempt-the-best-essays-written-by-the-2/
Jerrymit
2018-04-16 18:37
I like to get my inspiration from really meaningful phrases said by truly great people like “It is one thing to show a man that he is in error, and another to put him in possession of truth”, do you know where I can find thematic compiltaions of those?

http://thinkingbigconference.org/term-paper-writing-service-for-student-demands-6/
Dereknut
2018-04-16 18:34
It is my very first time visiting your website and I'm very interested. Many thanks for sharing and keep up ;)
http://www.casadovarandao.pt/en/dissertation-editing-services-dissertation-writing-55/
MosesTriny
2018-04-16 17:43
A short while ago I've come across one post which I believe you might find interesting. Somebody might take a steaming dump all over it, however it answered some of my questions.
MosesTriny
2018-04-16 16:57
Many thanks for sharing, I always learn something new from your posts.

发表评论:

Powered by emlog